jah-NEH-ris
SOC analyst specializing in detection and investigation, with a long-term focus on AI security. Background in IT, networking, graphic & web design, and blockchain.
Incident response on a compromised legacy Linux server in an isolated VirtualBox lab, following PICERL. Found a backdoored FTP service (CVE-2011-2523) and a planted root shell, preserved evidence, contained and hardened the host, and wrote technical and executive reports. Includes a defender's view mapping each stage to MITRE ATT&CK with draft Splunk detections.
Tools and topics: Nmap, Wireshark, iptables, Linux, Incident response, MITRE ATT&CK
AI assistants are part of my analyst toolkit for research, scripting and documentation. I treat AI output as a lead, not evidence: every finding is verified with a primary tool or source before it goes into a report. My long-term focus is AI security: how these systems are attacked, misused and defended.
In the SOC lab I used AI to help plan scans, parse output, research CVEs and draft reports, and I checked every AI-suggested finding with a manual tool before accepting it as evidence.
Tools and topics: Trust but verify, Incident response
I am building a home SOC lab on my Fedora workstation with KVM and libvirt: a Splunk server and a Windows 11 endpoint on an isolated network with no route out, with a Kali attacker to follow.
So far the isolated network is up and verified (the Splunk VM cannot reach the internet), Splunk Enterprise is running on Ubuntu behind a host firewall that only allows SSH, the web interface and forwarder traffic, and a clean snapshot is saved.
The Windows 11 endpoint runs with Secure Boot and an emulated TPM. Sysmon and the Splunk Universal Forwarder are staged and checked against their published hashes before install.
Next: get Sysmon telemetry flowing into Splunk, then use it to validate the detections from my SOC lab write-up and build new ones with Atomic Red Team.
A legacy Ubuntu server was flagged for anomalous traffic. In an isolated VirtualBox host-only network, I scanned it from Kali and found about 25 open ports, including vsftpd 2.3.4 with its known backdoor (CVE-2011-2523) and a root shell already listening on port 1524.
The scanner could only guess the FTP version because the banner was masked. A targeted script scan confirmed the real version. Taking the guess at face value would have mislabeled the entry point.
I captured volatile state before isolating the host, then removed the backdoor, disabled xinetd, firewalled the entry point and verified the ports were closed. I wrote it up as a technical report and an executive briefing.
Then I worked the defender's side: for each stage (the scan, the backdoor trigger, the root shell, the persistence) what a SOC would see, where the signal lives, the MITRE ATT&CK technique, and draft Splunk searches to catch it. Validating those against replayed traffic is next.
Full write-up: github.com/janyris/soc-legacy-server-breach